Linux Distros Unpatched Vulnerability : CVE-2026-76031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-76026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML...

RHEL 9 : xterm (RHSA-2026:92418)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:92418 advisory. The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that...

CVE-2026-119777: Red Hat, GStreamer project: A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to...

PT-2026-133672

Name of the Vulnerable Software and Affected Versions aws-nitro-enclaves-sdk-c versions prior to 0.4.6 Description A use-after-free and double-free issue exists in the SetClient command handler of the kmstool-enclave sample application. This flaw allows an application running on the parent EC2...

Amazon Linux 2 : edk2 (ALAS-2026-4047)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4047 advisory. EDK2 contains a vulnerability in BIOS where a user may cause Out-of-boundsWrite, ClassicBuffer Overflow, and Incorrect Calculation of Buffer Size by remote access. Successful exploitation of this...

Important: edk2

Issue Overview: EDK2 contains a vulnerability in BIOS where a user may cause "Out-of-bounds Write", Classic Buffer Overflow, and "Incorrect Calculation of Buffer Size" by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact...

PT-2026-134194

Metalama is a Roslyn-based open-source patterns and architecture toolkit for C. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. The pipe connects...

PT-2026-134216

In Trail of Bits fickling through 0.1.12, a pickle STACK GLOBAL operand carrying a dotted qualname for example "Values.read file" is resolved by pickle's find class through getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading...

PT-2026-134238

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit Headers"Accept: ", "Content-Type: " attribute string without escaping quotation marks. A crafted...

PT-2026-134415

Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH...

CVE-2026-116243: pgadmin.org pgAdmin 4: pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

CVE-2026-16760: trailofbits fickling: In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the…

In Trail of Bits fickling through 0.1.12, the processimport method in fickle.py adds an imported name to the likelysafeimports set whenever the source module is present in sys.stdlibmodulenames and the name is absent from the UNSAFEIMPORTS denylist, without inspecting what the name resolves to or...

CVE-2026-61725: hasenbanck sevenz-rust2: sevenz-rust2 is a Rust-native 7z compressor and `decompress`or

sevenz-rust2 is a Rust-native 7z compressor and decompressor. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In src/util/decompress.rs, decompressimpl computes each destination with dest.joinentry.name without normalizin...

CVE-2026-63344: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit library

Refitter is a tool for generating a C REST API client using the Refit library. Prior to 2.1.2, content-type keys in the content maps of requestBody/responses are emitted verbatim into a Refit Headers"Accept: ", "Content-Type: " attribute string without escaping quotation marks. A crafted...

Microsoft PowerShell 7.4.x < 7.4.22 / 7.5.x < 7.5.13 / 7.6.x < 7.6.9 RCE (macOS)

The version of Microsoft PowerShell installed on the remote macOS host is 7.4.x prior to 7.4.22, 7.5.x prior to 7.5.13, or 7.6.x prior to 7.6.9. It is, therefore, affected by a remote code execution vulnerability. An out-of-bounds write in the Brotli decoder used by PowerShell 7 allows an...

Joomla Content Editor 2.9.99.4 Unauthenticated Remote Code Execution

Joomla Content Editor versions through 2.9.99.4 contain an improper access control vulnerability in profile import functionality that allows unauthenticated attackers to upload PHP files and execute code. https://packetstorm.news/download/238566...

Google Chrome 70.0.3538.0 V8 Type Confusion

A proof of concept for a V8 TurboFan Object.create type confusion in Google Chrome version 70.0.3538.0 that achieves arbitrary memory read/write and executes calculator shellcode through a WebAssembly RWX page. https://packetstorm.news/download/238565...

LibreNMS REST API Unauthenticated Access Code Execution

The vulnerability related to the implementation of the REST API interface in the LibreNMS network monitoring system stems from flaws in its authentication process. Exploitation of this vulnerability could enable a remote attacker to gain unauthorized access to protected information or execute...

PT-2026-133715

Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component...